MAL-2026-13520 Malicious code in @aster110/cc2wechat (npm)

The package runs a daemon that long-polls Tencent's iLink Bot API (ilinkai.weixin.qq.com) for incoming WeChat messages and forwards each message body into a locally hosted AI agent that is spawned with all approval and sandbox gates disabled. Specifically, TmuxDelivery.deliver writes the message text (sendToSession(sessionName, "[微信...] " + ctx.text)) into a tmux session whose command line is CC2WECHAT_CONTEXT=... claude --dangerously-skip-permissions, using tmux load-buffer + paste-buffer + send-keys Enter to submit the input. An alternative backend spawns codex exec --json --dangerously-bypass-approvals-and-sandbox and feeds the same WeChat message stream into it. Because these AI CLIs are configured to auto-execute shell commands and filesystem operations without prompts when safety flags are disabled, any party able to send a WeChat message to the linked account can drive arbitrary shell and file operations on the machine running the daemon. The tool is documented in the README as full-host access requiring a disposable VM. The startup entry point is a bin CLI (cc2wechat start), so the remote-shell surface materializes when the operator launches the daemon rather than on npm install or require().